CVE-2026-34197
published 2026-04-07CVE-2026-34197: Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ…
PriorityP195high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2026-04-30
Exploited in the wild
EPSS
97.22%
99.9th percentile
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.
Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including
BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String).
An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext.
Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().
This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3.
Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | activemq | < 5.19.7 | 5.19.7 |
| apache | activemq | < 5.19.6 | 5.19.6 |
| apache | activemq | < 5.19.4 | 5.19.4 |
| apache | activemq | >= 6.0.0 < 6.2.6 | 6.2.6 |
| apache | activemq | >= 6.0.0 < 6.2.5 | 6.2.5 |
| apache | activemq | >= 6.0.0 < 6.2.3 | 6.2.3 |
| apache | activemq_broker | < 5.19.7 | 5.19.7 |
| apache | activemq_broker | < 5.19.6 | 5.19.6 |
| apache | activemq_broker | < 5.19.4 | 5.19.4 |
| apache | activemq_broker | >= 6.0.0 < 6.2.6 | 6.2.6 |
| apache | activemq_broker | >= 6.0.0 < 6.2.5 | 6.2.5 |
| apache | activemq_broker | >= 6.0.0 < 6.2.3 | 6.2.3 |
| apache_software_foundation | apache_activemq | < 5.19.7 | 5.19.7 |
| apache_software_foundation | apache_activemq | >= 6.0.0 < 6.2.6 | 6.2.6 |
| apache_software_foundation | apache_activemq_all | < 5.19.7 | 5.19.7 |
| apache_software_foundation | apache_activemq_all | >= 6.0.0 < 6.2.6 | 6.2.6 |
| apache_software_foundation | apache_activemq_broker | < 5.19.7 | 5.19.7 |
| apache_software_foundation | apache_activemq_broker | >= 6.0.0 < 6.2.6 | 6.2.6 |
| candlepinproject | candlepin | — | — |
| debian | activemq | — | — |
| log4j_2 | log4j | — | — |
| satellite_el8 | candlepin | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Search ActiveMQ broker logs for suspicious broker connections using the internal VM transport protocol combined with the brokerConfig=xbean:http:// query parameter as an indicator of exploitation. ↗
- →If a warning message about a configuration problem appears in ActiveMQ logs during connection attempts, the payload has already been executed — the command execution occurs during multiple connection attempts. ↗
- →Audit all ActiveMQ deployments for externally accessible Jolokia endpoints at /api/jolokia/; restrict access to trusted networks and enforce strong authentication or disable Jolokia where not required. ↗
- →On ActiveMQ versions 6.0.0–6.1.1, CVE-2024-32114 exposes the Jolokia API without authentication, making CVE-2026-34197 effectively an unauthenticated RCE — prioritize these versions for immediate patching. ↗
- →Monitor for invocations of BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String) MBean operations via Jolokia, particularly with crafted discovery URI arguments containing remote HTTP URLs. ↗
- →Exploitation activity peaked on April 14, 2026 per Fortinet FortiGuard Labs telemetry; use this date as a reference point for retrospective log analysis. ↗
- →Check Point IPS signature 'Apache ActiveMQ Code Injection (CVE-2026-34197)' can be used for network-level detection of exploitation attempts. ↗
- ·Default credentials (admin:admin) are common in many ActiveMQ environments, lowering the effective bar for exploitation even on versions that require authentication. ↗
- ·The bypass variant (CVE-2026-45505) uses non-parenthesized discovery wrapper URIs (e.g., masterslave:vm://...,... or static:vm://...) to evade the patch for CVE-2026-34197; patching to 5.19.7 or 6.2.6 is required to address both. ↗
- ·Spring's ResourceXmlApplicationContext instantiates all singleton beans before BrokerService validates the configuration, meaning code execution occurs before any broker-level validation can block it. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
ghsa8.8HIGH
osv8.8HIGH
vulncheck8.8HIGH
cisa8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.
ghsa_unreviewed·2026-06-01·CVSS 8.8
CVE-2026-45505 [HIGH] CWE-20 Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.
Non-parenthesized discovery wrappers such as `masterslave:vm://...,...`
and `static:vm://...` incorrectly pass validation allowing bypass of fix in CVE-2026-34197.
Original description from CVE-2026-34197.
Apache ActiveMQ exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery UR that triggers the VM transport's brokerConfig parameter t
GHSA
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue
ghsa·2026-06-01·CVSS 8.8
CVE-2026-45505 [HIGH] CWE-20 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.
Non-parenthesized discovery wrappers such as `masterslave:vm://...,...`
and `static:vm://...` incorrectly pass validation allowing bypass of fix in CVE-2026-34197.
Original description from CVE-2026-34197.
Apache ActiveMQ exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operat
GHSA
GHSA-w3w2-mpp5-92gm: Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apa
ghsa_unreviewed·2026-04-24·CVSS 8.8
CVE-2026-40466 [HIGH] CWE-20 GHSA-w3w2-mpp5-92gm: Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apa
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.
An authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using an HTTP Discovery transport via BrokerView.addNetworkConnector or BrokerView.addConnector through Jolokia if the activemq-http module is on the classpath.
A malicious HTTP endpoint can return a VM transport through the HTTP URI which will bypass the validation added in CVE-2026-34197. The attacker can then use the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext.
Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService
GHSA
Apache ActiveMQ Vulnerable to Improper Input Validation and Code Injection
ghsa·2026-04-24·CVSS 8.8
CVE-2026-40466 [HIGH] CWE-20 Apache ActiveMQ Vulnerable to Improper Input Validation and Code Injection
Apache ActiveMQ Vulnerable to Improper Input Validation and Code Injection
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.
An authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using an HTTP Discovery transport via BrokerView.addNetworkConnector or BrokerView.addConnector through Jolokia if the activemq-http module is on the classpath.
A malicious HTTP endpoint can return a VM transport through the HTTP URI which will bypass the validation added in CVE-2026-34197. The attacker can then use the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext.
Because Spring's ResourceXml
VulDB
Apache ActiveMQ Broker/ActiveMQ Jolokia MBeans Remote Code Execution (EUVD-2026-19588 / Nessus ID 305955)
vuldb·2026-04-16·CVSS 8.8
CVE-2026-34197 [HIGH] Apache ActiveMQ Broker/ActiveMQ Jolokia MBeans Remote Code Execution (EUVD-2026-19588 / Nessus ID 305955)
A vulnerability was found in Apache ActiveMQ Broker and ActiveMQ. It has been classified as critical. This affects an unknown function of the component Jolokia MBeans. Performing a manipulation results in Remote Code Execution.
This vulnerability is known as CVE-2026-34197. Remote exploitation of the attack is possible. Furthermore, an exploit is available.
Upgrading the affected component is recommended.
OSV
CVE-2026-34197: Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ
osv·2026-04-07·CVSS 8.8
CVE-2026-34197 [HIGH] CVE-2026-34197: Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbi
OSV
CVE-2026-34197: Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ
osv·2026-04-07·CVSS 8.8
CVE-2026-34197 [HIGH] CVE-2026-34197: Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbi
GHSA
Authenticated Apache ActiveMQ Broker and Apache ActiveMQ users could perform RCE via Jolokia MBeans
ghsa·2026-04-07
CVE-2026-34197 [HIGH] CWE-20 Authenticated Apache ActiveMQ Broker and Apache ActiveMQ users could perform RCE via Jolokia MBeans
Authenticated Apache ActiveMQ Broker and Apache ActiveMQ users could perform RCE via Jolokia MBeans
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.
Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including
BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String).
An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext.
Because Spring's ResourceXmlApplica
GHSA
GHSA-rxpj-7qvf-xv32: Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ
ghsa_unreviewed·2026-04-07
CVE-2026-34197 [HIGH] CWE-20 GHSA-rxpj-7qvf-xv32: Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.
Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including
BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String).
An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext.
Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, ar
VulnCheck
Apache ActiveMQ Improper Input Validation
vulncheck·2026·CVSS 8.8
CVE-2026-40466 [HIGH] Apache ActiveMQ Improper Input Validation
Apache ActiveMQ Improper Input Validation
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.
An authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using an HTTP Discovery transport via BrokerView.addNetworkConnector or BrokerView.addConnector through Jolokia if the activemq-http module is on the classpath.
A malicious HTTP endpoint can return a VM transport through the HTTP URI which will bypass the validation added in CVE-2026-34197. The attacker can then use the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext.
Because Spring's ResourceXmlApplicationContext instantiates a
VulnCheck
Apache ActiveMQ Improper Input Validation Vulnerability
vulncheck·2026·CVSS 8.8
CVE-2026-34197 [HIGH] CWE-20 Apache ActiveMQ Improper Input Validation Vulnerability
Apache ActiveMQ Improper Input Validation Vulnerability
Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection.
Affected: Apache ActiveMQ
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Exploitation References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Remediation Due: 2026-04-30
Red Hat
activemq: Apache ActiveMQ: Arbitrary Code Execution via crafted discovery URI bypass
vendor_redhat·2026-06-01·CVSS 8.8
CVE-2026-45505 [HIGH] CWE-502 activemq: Apache ActiveMQ: Arbitrary Code Execution via crafted discovery URI bypass
activemq: Apache ActiveMQ: Arbitrary Code Execution via crafted discovery URI bypass
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.
Non-parenthesized discovery wrappers such as `masterslave:vm://...,...`
and `static:vm://...` incorrectly pass validation allowing bypass of fix in CVE-2026-34197.
Original description from CVE-2026-34197.
Apache ActiveMQ exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations wit
CISA
Apache ActiveMQ Improper Input Validation Vulnerability
cisa·2026-04-16·CVSS 8.8
CVE-2026-34197 [HIGH] CWE-20 Apache ActiveMQ Improper Input Validation Vulnerability
Vulnerability: Apache ActiveMQ Improper Input Validation Vulnerability
Affected: Apache ActiveMQ
Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection.
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txt ; https://nvd.nist.gov/vuln/detail/CVE-2026-34197
Remediation Due Date: 2026-04-30
Red Hat
org.apache.activemq/activemq-broker: org.apache.activemq/activemq-all: Apache ActiveMQ: Arbitrary Code Execution via crafted discovery URI in Jolokia JMX-HTTP bridge
vendor_redhat·2026-04-07·CVSS 8.8
CVE-2026-34197 [HIGH] CWE-78 org.apache.activemq/activemq-broker: org.apache.activemq/activemq-all: Apache ActiveMQ: Arbitrary Code Execution via crafted discovery URI in Jolokia JMX-HTTP bridge
org.apache.activemq/activemq-broker: org.apache.activemq/activemq-all: Apache ActiveMQ: Arbitrary Code Execution via crafted discovery URI in Jolokia JMX-HTTP bridge
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.
Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including
BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String).
An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using Re
Debian
CVE-2026-34197: activemq - Improper Input Validation, Improper Control of Generation of Code ('Code Injecti...
vendor_debian·2026·CVSS 8.8
CVE-2026-34197 [HIGH] CVE-2026-34197: activemq - Improper Input Validation, Improper Control of Generation of Code ('Code Injecti...
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbi
Suricata
ET WEB_SPECIFIC_APPS Apace ActiveMQ Jolokia addNetworkConnector Remote Code Execution Attempt (CVE-2026-34197)
suricata·2026-04-08·CVSS 8.8
CVE-2026-34197 [HIGH] ET WEB_SPECIFIC_APPS Apace ActiveMQ Jolokia addNetworkConnector Remote Code Execution Attempt (CVE-2026-34197)
ET WEB_SPECIFIC_APPS Apace ActiveMQ Jolokia addNetworkConnector Remote Code Execution Attempt (CVE-2026-34197)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Apace ActiveMQ Jolokia addNetworkConnector Remote Code Execution Attempt (CVE-2026-34197)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:12; content:"/api/jolokia"; fast_pattern; http.content_type; bsize:16; content:"application/json"; http.request_body; content:"|22|type|22|"; content:"|22|exec|22|"; within:15; content:"|22|mbean|22|"; content:"|22|operation|22|"; content:"|22|addNetworkConnector|22|"; within:30; content:"|22|arguments|22|"; content:"|22|static|3a 28|vm|3a 2f 2f|"; within:30; content:"xbean|3a|http"; distance:0; reference:url,horizon3.ai/attack-research/disclosures/c
Suricata
ET HUNTING MethodInvokingFactoryBean java.lang.Runtime getRuntime exec method XML Payload Request - Possible Remote Code Execution Attempt
suricata·2026-04-08
CVE-2026-34197 ET HUNTING MethodInvokingFactoryBean java.lang.Runtime getRuntime exec method XML Payload Request - Possible Remote Code Execution Attempt
ET HUNTING MethodInvokingFactoryBean java.lang.Runtime getRuntime exec method XML Payload Request - Possible Remote Code Execution Attempt
Rule: alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING MethodInvokingFactoryBean java.lang.Runtime getRuntime exec method XML Payload Request - Possible Remote Code Execution Attempt"; flow:established,to_server; http.method; content:"GET"; http.request_body; content:"|3c|bean|20|id|3d 22|exec|22|"; content:"class|3d 22|org.springframework.beans.factory.config.MethodInvokingFactoryBean|22 3e|"; fast_pattern; within:100; content:"|3c|property|20|name|3d 22|targetClass|22|"; content:"value|3d 22|java.lang.Runtime|22 2f 3e|"; within:35; content:"|3c|property|20|name|3d 22|targetMethod|22|"; content:"value|3d 22|getRuntime|22 2f 3e|"; within:
Metasploit
Apache ActiveMQ RCE via Jolokia addNetworkConnector
metasploit
CVE-2026-34197 Apache ActiveMQ RCE via Jolokia addNetworkConnector
Apache ActiveMQ RCE via Jolokia addNetworkConnector
Apache ActiveMQ exposes a Jolokia JMX-over-HTTP API at /api/jolokia/. An authenticated attacker can invoke the addNetworkConnector() MBean operation with a crafted URI that causes the broker to fetch a remote Spring XML configuration over HTTP. The Spring XML instantiates a ProcessBuilder bean that executes attacker-supplied OS commands. Default credentials (admin:admin) are accepted by many installations. Verified on docker image
Nuclei
Apache ActiveMQ - Remote Code Execution
nuclei·CVSS 8.8
CVE-2026-34197 [HIGH] Apache ActiveMQ - Remote Code Execution
Apache ActiveMQ - Remote Code Execution
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the Broker
Nuclei
Apache ActiveMQ - Remote Code Execution via HTTP Discovery Transport Bypass
nuclei·CVSS 8.8
CVE-2026-40466 [HIGH] Apache ActiveMQ - Remote Code Execution via HTTP Discovery Transport Bypass
Apache ActiveMQ - Remote Code Execution via HTTP Discovery Transport Bypass
Apache ActiveMQ before 5.19.6 and 6.0.0 through 6.2.4 is vulnerable to remote code execution via a bypass of the CVE-2026-34197 security fix. The original fix blocked the "vm://" transport scheme in BrokerView.addNetworkConnector() and BrokerView.addConnector() to prevent authenticated attackers from loading malicious Spring XML configurations via the Jolokia API. However, the fix only denied the "vm" scheme. An attacker can bypass this restriction by using the HTTP Discovery transport(http://attacker/discovery), which is not in the denied scheme list. The attacker-controlled HTTP endpoint returns a vm:// transport URI as a second-stage response, which then loads a remote Spring XML application context, leading to
Rapid7
Weekly Metasploit Update: Apache ActiveMQ RCE, Gogs Rebase RCE, and Windows Kernel Pointer Enum
blogs_rapid7·2026-06-05·CVSS 8.8
CVE-2026-34197 [HIGH] Weekly Metasploit Update: Apache ActiveMQ RCE, Gogs Rebase RCE, and Windows Kernel Pointer Enum
## When Open Source is a bit too Open
Several fun modules landed this week, including an Apache RCE, Windows Kernel pointer collection, and Gogs RCE via naming. Leading off is Gogs' RCE that allows an attacker to execute commands by naming their branch --exec and requesting a rebase.
Another useful post module by CharlesQuinnDev enumerates the Kernel pointers leaked via the popular NtQuerySystemInformation technique. Those exposed pointers, combined with a good write primitive, make local privilege escalation easier to accomplish. Several local privilege escalations already use that technique, so exposing just that technique was a great call!
## New module content (3)
## Apache ActiveMQ RCE via Jolokia addNetworkConnector
Authors: dinosn and h00die
Type: Exploit
Pull request: #21497 c
Checkpoint
AI Threat Landscape Digest March-April 2026
blogs_checkpoint·2026-05-26
CVE-2026-34197 AI Threat Landscape Digest March-April 2026
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
AI Research 3
Android Malware 23
Artificial Intelligence 4
ChatGPT 3
Check Point Research Publications 457
Cloud Security 1
CPRadio 44
Crypto 2
Data & Threat Intelligence 2
Data Analysis 0
Demos 22
Global Cyber Attack Reports 409
How To Guides 13
Ransomware 5
Russo-Ukrainian War 1
Security Report 1
Threat and data analysis 0
Threat Research 175
Web 3.0 Security 11
Wipers 0
## AI Threat Landscape Digest March-April 2026
## Executive Summary
During the March–April 2026 reporting period, AI use in offensive operations advanced from development and planning to re
Hackernews
ThreatsDay Bulletin: $290M DeFi Hack, macOS LotL Abuse, ProxySmart SIM Farms +25 New Stories
blogs_hackernews·2026-04-23
CVE-2026-27175 ThreatsDay Bulletin: $290M DeFi Hack, macOS LotL Abuse, ProxySmart SIM Farms +25 New Stories
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ThreatsDay Bulletin: $290M DeFi Hack, macOS LotL Abuse, ProxySmart SIM Farms +25 New Stories
You scroll past one incident and see another that feels familiar, like it should have been fixed years ago, but it still works with small changes. Same bugs. Same mistakes.
The supply chain is messy. Packages you did not check are stealing data, adding backdoors, and spreading. Attacking the systems behind apps is easier than breaking the apps themselves. The exploits are simple but still work, giving attackers easy access.
AI tools are also part of the problem now. They trust bad input and take real actions, which makes the damage
Bleepingcomputer
Actively exploited Apache ActiveMQ flaw impacts 6,400 servers
blogs_bleepingcomputer·2026-04-21·CVSS 8.8
CVE-2026-34197 [HIGH] Actively exploited Apache ActiveMQ flaw impacts 6,400 servers
## Actively exploited Apache ActiveMQ flaw impacts 6,400 servers
## Sergiu Gatlan
Nonprofit security organization Shadowserver found that over 6,400 Apache ActiveMQ servers exposed online are vulnerable to ongoing attacks exploiting a high-severity code injection vulnerability.
Apache ActiveMQ is the most popular open-source multi-protocol message broker for asynchronous communication between Java applications.
Tracked as CVE-2026-34197 , the vulnerability was discovered by Horizon3 researcher Naveen Sunkavally using the Claude AI assistant after remaining undetected for 13 years .
As Sunkavally explained, this security flaw stems from an improper input validation weakness that enables authenticated threat actors to execute arbitrary code on unpatched systems. The Apache maintainers h
Checkpoint
20th April – Threat Intelligence Report
blogs_checkpoint·2026-04-20
CVE-2026-34197 20th April – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 20th April – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 20th April, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
Booking.com, the Amsterdam-based travel platform, has confirmed a data breach after unauthorized parties accessed reservation data linked to some customers. Exposed information included names, email addresses, phone numbers, physical addresses, and booking details, creating phishing risk, while the company reset reservation PI
Hackernews
Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation
blogs_hackernews·2026-04-17·CVSS 8.8
CVE-2026-34197 [HIGH] Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation
A recently disclosed high-severity security flaw in Apache ActiveMQ Classic has come under active exploitation in the wild, per the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
To that end, the agency has added the vulnerability, tracked as CVE-2026-34197 (CVSS score: 8.8), to its Known Exploited Vulnerabilities ( KEV ) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by April 30, 2026.
CVE-2026-34197 has been described as a case of improper input validation that could lead to code injection, eff
Bleepingcomputer
CISA flags Apache ActiveMQ flaw as actively exploited in attacks
blogs_bleepingcomputer·2026-04-17·CVSS 8.8
CVE-2026-34197 [HIGH] CISA flags Apache ActiveMQ flaw as actively exploited in attacks
## CISA flags Apache ActiveMQ flaw as actively exploited in attacks
## Sergiu Gatlan
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned on Thursday that a high-severity Apache ActiveMQ vulnerability patched earlier this month is now actively exploited in attacks.
Apache ActiveMQ is the most popular open-source Java-based message broker for asynchronous communication between applications.
Tracked as CVE-2026-34197 , the security flaw has gone undetected for 13 years and was discovered by Horizon3 researcher Naveen Sunkavally using the Claude AI assistant.
Sunkavally explained that the vulnerability stems from improper input validation, which allows authenticated threat actors to execute arbitrary code via injection attacks. The Apache maintainers patched the vulner
Hackernews
⚡ Weekly Recap: Fiber Optic Spying, Windows Rootkit, AI Vulnerability Hunting and More
blogs_hackernews·2026-04-13·CVSS 8.6
[HIGH] ⚡ Weekly Recap: Fiber Optic Spying, Windows Rootkit, AI Vulnerability Hunting and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Fiber Optic Spying, Windows Rootkit, AI Vulnerability Hunting and More
Monday is back, and the weekend’s backlog of chaos is officially hitting the fan. We are tracking a critical zero-day that has been quietly living in your PDFs for months, plus some aggressive state-sponsored meddling in infrastructure that is finally coming to light. It is one of those mornings where the gap between a quiet shift and a full-blown incident response is basically non-existent.
The variety this week is particularly nasty. We have AI models being turned into autonomous exploit engines, North Korean groups playing the long game
Hackernews
ThreatsDay Bulletin: Hybrid P2P Botnet, 13-Year-Old Apache RCE and 18 More Stories
blogs_hackernews·2026-04-09
ThreatsDay Bulletin: Hybrid P2P Botnet, 13-Year-Old Apache RCE and 18 More Stories
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ThreatsDay Bulletin: Hybrid P2P Botnet, 13-Year-Old Apache RCE and 18 More Stories
Thursday. Another week, another batch of things that probably should've been caught sooner but weren't.
This one's got some range — old vulnerabilities getting new life, a few "why was that even possible" moments, attackers leaning on platforms and tools you'd normally trust without thinking twice. Quiet escalations more than loud zero-days, but the kind that matter more in practice anyway.
Mix of malware, infrastructure exposure, AI-adjacent weirdness, and some supply chain stuff that's... not great. Let's get into it.
A new variant of the
Bleepingcomputer
13-year-old bug in ActiveMQ lets hackers remotely execute commands
blogs_bleepingcomputer·2026-04-08·CVSS 8.5
CVE-2026-34197 [HIGH] 13-year-old bug in ActiveMQ lets hackers remotely execute commands
## 13-year-old bug in ActiveMQ lets hackers remotely execute commands
## Bill Toulas
This is also the reason why it was missed for more than a decade.
Apache ActiveMQ is an open-source message broker written in Java that handles asynchronous communication via message queues or topics.
Although ActiveMQ has released a newer ‘Artemis’ branch with better performance, the ‘Classic’ edition impacted by CVE-2026-34197 is widely deployed in enterprise, web backends, government, and company systems built on Java.
Horizon3 researcher Naveen Sunkavally found the issue "with nothing more than a couple of basic prompts" in Claude. "This was 80% Claude with 20% gift-wrapping by a human," he said.
Sunkavally notes that Claude pointed to the issue after examining multiple individual components (Jol
Sans Isc
SANS Stormcast Thursday, April 9th, 2026: Honeypot Fingerprinting; Microsoft Locks Developer Accounts; ActiveMQ Vuln;
blogs_sans_isc·CVSS 8.8
[HIGH] SANS Stormcast Thursday, April 9th, 2026: Honeypot Fingerprinting; Microsoft Locks Developer Accounts; ActiveMQ Vuln;
Handler on Duty:
Xavier Mertens
Threat Level:
Green
Podcast Detail
SANS Stormcast Thursday, April 9th, 2026: Honeypot Fingerprinting; Microsoft Locks Developer Accounts; ActiveMQ Vuln;
If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/9886.mp3
previous
Honeypot Fingerprinting; Microsoft Locks Developer Accounts; ActiveMQ Vuln;
00:00
My Next Class
Click HERE to learn more about classes Johannes is teaching for SANS
Honeypot Fingerprinting
https://isc.sans.edu/diary/More%20Honeypot%20Fingerprinting%20Scans/32878
Microsoft Locks Accounts for Privacy/Encryption Related Developers
https://sourceforge.net/p/veracrypt/discussion/general/thread/9620d7a4b3/ https://news.ycombinator.com/item?id=47
Wiz
CVE-2026-34197 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.8
CVE-2026-34197 [HIGH] CVE-2026-34197 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-34197 :
Apache ActiveMQ Classic vulnerability analysis and mitigation
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.
Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including
BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String).
An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext.
Because Spring's ResourceXmlApplicationContext insta
Bugzilla
CVE-2026-45505 activemq-cpp: Apache ActiveMQ: Arbitrary Code Execution via crafted discovery URI bypass [fedora-all]
bugzilla·2026-06-30·CVSS 8.8
CVE-2026-45505 [HIGH] CVE-2026-45505 activemq-cpp: Apache ActiveMQ: Arbitrary Code Execution via crafted discovery URI bypass [fedora-all]
CVE-2026-45505 activemq-cpp: Apache ActiveMQ: Arbitrary Code Execution via crafted discovery URI bypass [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.
Non-parenthesized discovery wrappers such as `masterslave:vm://...,...`
and `static:vm://...` incorrectly pass validation allowing bypass of fix in CVE-2026-34197.
Original description from CVE-2026-34197.
Apache ActiveMQ exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web con
Bugzilla
CVE-2026-45505 activemq-cpp: Apache ActiveMQ: Arbitrary Code Execution via crafted discovery URI bypass [epel-all]
bugzilla·2026-06-30·CVSS 8.8
CVE-2026-45505 [HIGH] CVE-2026-45505 activemq-cpp: Apache ActiveMQ: Arbitrary Code Execution via crafted discovery URI bypass [epel-all]
CVE-2026-45505 activemq-cpp: Apache ActiveMQ: Arbitrary Code Execution via crafted discovery URI bypass [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.
Non-parenthesized discovery wrappers such as `masterslave:vm://...,...`
and `static:vm://...` incorrectly pass validation allowing bypass of fix in CVE-2026-34197.
Original description from CVE-2026-34197.
Apache ActiveMQ exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web conso
Bugzilla
CVE-2026-45505 activemq: Apache ActiveMQ: Arbitrary Code Execution via crafted discovery URI bypass
bugzilla·2026-06-01·CVSS 8.8
CVE-2026-45505 [HIGH] CVE-2026-45505 activemq: Apache ActiveMQ: Arbitrary Code Execution via crafted discovery URI bypass
CVE-2026-45505 activemq: Apache ActiveMQ: Arbitrary Code Execution via crafted discovery URI bypass
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.
Non-parenthesized discovery wrappers such as `masterslave:vm://...,...`
and `static:vm://...` incorrectly pass validation allowing bypass of fix in CVE-2026-34197.
Original description from CVE-2026-34197.
Apache ActiveMQ exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke t
Bugzilla
CVE-2026-40466 org.apache.activemq/activemq-all: org.apache.activemq/activemq-broker: Apache ActiveMQ: Arbitrary code execution via improper input validation in HTTP Discovery transport
bugzilla·2026-04-24·CVSS 8.8
CVE-2026-40466 [HIGH] CVE-2026-40466 org.apache.activemq/activemq-all: org.apache.activemq/activemq-broker: Apache ActiveMQ: Arbitrary code execution via improper input validation in HTTP Discovery transport
CVE-2026-40466 org.apache.activemq/activemq-all: org.apache.activemq/activemq-broker: Apache ActiveMQ: Arbitrary code execution via improper input validation in HTTP Discovery transport
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.
An authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using an HTTP Discovery transport via BrokerView.addNetworkConnector or BrokerView.addConnector through Jolokia if the activemq-http module is on the classpath.
A malicious HTTP endpoint can return a VM transport through the HTTP URI which will bypass the validation added in CVE-2026-34197. The attacker can then use the VM transport's brokerConfig parameter to
Bugzilla
CVE-2026-34197 org.apache.activemq/activemq-broker: org.apache.activemq/activemq-all: Apache ActiveMQ: Arbitrary Code Execution via crafted discovery URI in Jolokia JMX-HTTP bridge
bugzilla·2026-04-07·CVSS 8.8
CVE-2026-34197 [HIGH] CVE-2026-34197 org.apache.activemq/activemq-broker: org.apache.activemq/activemq-all: Apache ActiveMQ: Arbitrary Code Execution via crafted discovery URI in Jolokia JMX-HTTP bridge
CVE-2026-34197 org.apache.activemq/activemq-broker: org.apache.activemq/activemq-all: Apache ActiveMQ: Arbitrary Code Execution via crafted discovery URI in Jolokia JMX-HTTP bridge
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.
Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including
BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String).
An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application
Bugzilla
CVE-2026-34197 log4j: Apache ActiveMQ: Arbitrary Code Execution via crafted discovery URI in Jolokia JMX-HTTP bridge [fedora-all]
bugzilla·2026-04-07·CVSS 8.8
CVE-2026-34197 [HIGH] CVE-2026-34197 log4j: Apache ActiveMQ: Arbitrary Code Execution via crafted discovery URI in Jolokia JMX-HTTP bridge [fedora-all]
CVE-2026-34197 log4j: Apache ActiveMQ: Arbitrary Code Execution via crafted discovery URI in Jolokia JMX-HTTP bridge [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txthttp://www.openwall.com/lists/oss-security/2026/04/06/3https://access.redhat.com/security/cve/CVE-2026-34197https://bugzilla.redhat.com/show_bug.cgi?id=2455869https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34197.jsonhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34197
2026-04-07
Published
2026-04-16
Added to CISA KEV
Exploited in the wild